SZ-100 changes its addres in remote AP from external to internal

At first, I connected remote AP (behind NAT) to a SZ-100 (connected with external IP) - everything works fine.The next step - put the SZ behind NAT and open all ports according to manual. AP connects, gets configuration, then heartbeat is lost and AP disconnects. I connected to AP via SHH and in AP settings I discovered that the controller address has changed from external a.b.c.d to its internal 192.168.xx.xx. So the controller changes this setting by itself, when gives the config to AP? How can I solve this?Thanks in advance.